a4f7b21dc88bdcf27cbe929d4bba979f759320b53f7e826bc0a77f55ebbf866c

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 01:07

Target
!ŞetUp_51286--#PaSꞨKḙy#$$/ErrorLog/DirectoryMonitor_[1MB]_[1].exe
Size 1.9MB
Sample240706-bgs7ea1dmn
SHA256 d74373f86c366409db3392258b552e35477ffd47d968d094abad170663193fc6
MD5 76067380db217854920c9652e6276ae1
SHA1 10442a38db18218953418b84bb8684a3fa399312
SHA512 91a42d2196b42515132ccdbc40dec46396995d80da5a44eded2d16fe4350c50a68a2556a80acdccef823bc233b4fa5a88a6423748e9fea2e23795339795857f9
SSDEEP 12288:hc6VJx4LOQyQLkoCPs+b4H4APA60jEcflSIQZXDVrZLpYHT:hhJxPQySCod3c8pZzhnYHT
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 1248	2292	DirectoryMonitor_[1MB]_[1].exe	31
PID 2292 wrote to memory of 1248	2292	DirectoryMonitor_[1MB]_[1].exe	31
PID 2292 wrote to memory of 1248	2292	DirectoryMonitor_[1MB]_[1].exe	31

C:\Users\Admin\AppData\Local\Temp\!ŞetUp_51286--#PaSꞨKḙy#$$\ErrorLog\DirectoryMonitor_[1MB]_[1].exe
"C:\Users\Admin\AppData\Local\Temp\!ŞetUp_51286--#PaSꞨKḙy#$$\ErrorLog\DirectoryMonitor_[1MB]_[1].exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2292 -s 536
  2⤵
  PID:1248

memory/2292-0-0x000007FEF6063000-0x000007FEF6064000-memory.dmp

Download

memory/2292-1-0x0000000000B50000-0x0000000000D40000-memory.dmp

Download

memory/2292-2-0x000007FEF6063000-0x000007FEF6064000-memory.dmp

Download